SB2019112616 - Red Hat Enterprise Linux 7 update for kernel
Published: November 26, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2019-15239)
The vulnerability allows a local user to cause a denial of service (DoS) condition on a target system.
The vulnerability exists due to multiple use-after-free conditions that exists because of a change to the "net/ipv4/tcp_output.c" file, which was incorrectly backported to earlier long-term versions. A local authenticated user can access the system, execute an application that submits malicious input and crash the software, resulting in a DoS condition.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
2) Out-of-bounds write (CVE-ID: CVE-2019-14821)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in the KVM coalesced MMIO support functionality due to incorrect processing of shared indexes. A local user can run a specially crafted application to trigger an out-of-bounds write error and write data to arbitrary address in the kernel memory.
Successful vulnerability exploitation may allow an attacker to execute arbitrary code on the system with root privileges.
Remediation
Install update from vendor's website.